Merge pull request #4225 from mzazrivec/escape_text_and_tooltip_in_tr…

…eebuilders_root Escape special chars in tooltip & text of TreeBuilder's root
ManageIQ · Jun 29, 2018 · c94908f · c94908f
2 parents 4c88630 + 522bded
commit c94908f
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/app/presenters/tree_builder.rb b/app/presenters/tree_builder.rb
@@ -173,7 +173,7 @@ def add_to_sandbox
   end
 
   def add_root_node(nodes)
-    root = nodes.first.merge!(root_options)
+    root = nodes.first.merge!(%i(text tooltip).each_with_object(root_options) { |key, hsh| hsh[key] = ERB::Util.html_escape(hsh[key]) })
     if root[:image]
       root[:image] = ActionController::Base.helpers.image_path(root[:image])
     else